Skip to content
OpenAdvisories
High · 8.8 CVE-2018-3758 EUVD-2022-2456GHSA-4w62-cq5r-5mmq

express-cart unrestricted file upload vulnerability

Published Jun 7, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: express-cart Package: express-cart Ecosystem: npm

Description

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

Affected products

VendorProductAffectedFixed
HackerOne express-cart 1.1.7 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm express-cart < 1.1.7 1.1.7 GHSA-4w62-cq5r-5mmq

References